JP5631164B2 - Multi-cluster distributed processing control system, representative client terminal, multi-cluster distributed processing control method - Google Patents

Description

  The present invention relates to a multi-cluster distributed processing control system, a representative client terminal, a distributed processing cluster, and a multi-cluster distributed processing control method.

  Conventionally, a multi-cluster distributed processing control system called Hadoop of Non-Patent Document 1 is known. In such a system, a server group of hundreds to tens of thousands of levels is configured as a processing system having one large resource (disk, memory, network, CPU, etc.). If the scale is relatively small, it can be operated as a single cluster, but if the scale increases and the number of users increases, it is more common to divide into multiple clusters and operate as a distributed processing cluster for security purposes. .

  In the above-described multi-cluster distributed processing control system, the distributed processing clusters are selectively used by designating a setting file that defines the attributes of the distributed processing clusters. The setting file includes a file system that is an attribute of the distributed processing cluster, an address of a server that manages and controls the distributed processing, a directory that stores data on the server that performs processing, and the like.

Apache Hadoop project, http://hadoop.apache.org/

However, in the conventional multi-cluster distributed processing control system described above, even though the client terminal can specify the distributed processing cluster, the distributed processing cluster does not have a function for authenticating the client terminal. As long as there is a configuration file for, any terminal becomes a client of the distributed processing cluster and can access the distributed processing cluster. In addition, there is a risk that unintended operations can be easily performed by intentionally changing the attribute of the setting file of the terminal or editing it by mistake.

  Furthermore, in a distributed processing cluster environment in which a client terminal accesses a plurality of clusters, there is a problem that it is difficult to easily control a plurality of client terminals that access the plurality of distributed processing clusters.

  The present invention has been made to solve the above-described problem, and is capable of realizing a multi-cluster distributed processing environment that can be controlled safely and easily, a multi-cluster distributed processing control system, a representative client terminal, a distributed processing cluster, and An object is to provide a multi-cluster distributed processing control method.

  In order to solve the above-described problem, the multi-cluster distributed processing control system of the present invention includes a representative client terminal connected from one or more client terminals and two or more distributed processes for performing the same processing in a distributed manner. A multi-cluster distributed processing control system including a cluster, wherein the representative client terminal stores a setting file for each of the distributed processing clusters, a user authentication unit for authenticating a user of the client terminal, Input means for receiving a command to be processed in the distributed processing cluster and a cluster identifier for identifying the distributed processing cluster from a user authenticated by the user authentication means, and the distributed processing indicated by the cluster identifier received by the input means Whether the cluster configuration file is the storage means The distributed processing in which the cluster identifier received by the input unit identifies the encryption unit to obtain and encrypt, the configuration file encrypted by the encryption unit, and the command received by the input unit Command sending means for sending to the cluster, processing result receiving means for receiving the processing result of the command sent by the command sending means from the distributed processing cluster, and output for outputting the processing result received by the processing result receiving means And the distributed processing cluster decrypts the encrypted setting file received by the command receiving means and command receiving means for receiving the encrypted setting file and command from the representative client terminal. And a setting file decoded by the decoding means. And a command received by the command receiving means when the determination means determines that the file is a setting file for the distributed processing cluster. And processing result transmitting means for transmitting the processing result of the command processed by the processing means to the representative client terminal.

  In addition, the multi-cluster distributed processing control method of the present invention is a multi-cluster distributed processing including a representative client terminal connected from one or more client terminals and two or more distributed processing clusters for distributed processing of the same processing. A multi-cluster distributed processing control method executed by a processing control system, wherein the representative client terminal stores a setting file relating to each of the distributed processing clusters, and the representative client terminal is a user terminal of the client terminal. A user authentication step for performing authentication, and an input step for receiving a command to be processed in the distributed processing cluster and a cluster identifier for identifying the distributed processing cluster from the user authenticated by the representative client terminal in the user authentication step; The representative class An encryption terminal that an ant terminal obtains and encrypts the setting file of the distributed processing cluster indicated by the cluster identifier received in the input step from the setting file stored in the storing step; and the representative client terminal includes: A command transmission step of transmitting the setting file encrypted in the encryption step and the command received in the input step to the distributed processing cluster identified by the cluster identifier received in the input step; A command receiving step in which the processing cluster receives the encrypted setting file and the command transmitted in the command transmitting step, and an encrypted setting file received in the command receiving step in the distributed processing cluster. A decoding step for decoding a file, a determination step for determining whether the setting file decoded in the decoding step is a setting file of the distributed processing cluster, and the distributed processing cluster When it is determined in the determination step that the file is a setting file of the distributed processing cluster, a processing step for processing the command received in the command receiving step, and the distributed processing cluster is a command processed in the processing step. A processing result transmission step for transmitting a processing result to the representative client terminal; a processing result receiving step for the representative client terminal to receive a processing result for the command transmitted in the processing result transmission step; and the representative client terminal for: The processing result reception step And an output step for outputting the processing result received in the network.

  According to the present invention, processing instructions from one or more client terminals to two or more distributed processing clusters are relayed by the representative client terminal. Accordingly, the relay processing related to the multi-cluster distributed processing environment can be unified by the representative client terminal, and a multi-cluster distributed processing environment that can be easily controlled can be realized.

  Further, according to the present invention, the setting file related to each distributed processing cluster is stored in the representative client terminal. As a result, the setting file is stored not in each client terminal but in the representative client terminal. Therefore, it is possible to prevent each client terminal from intentionally changing the setting file on its own terminal or editing it by mistake. A controllable multi-cluster distributed processing environment can be realized.

  According to the present invention, the representative client terminal authenticates the user of the client terminal and then receives a command and a cluster identifier from the user. As a result, a processing command to the distributed processing cluster can be received from an authenticated user, so that a multi-cluster distributed processing environment that can be safely controlled can be realized. Furthermore, since the representative client terminal accepts the cluster identifier of the distributed processing cluster instead of the setting file of the distributed processing cluster to be processed from the user, the processing is not performed based on the unreliable setting file received from the user. A multi-cluster distributed processing environment can be realized.

  Further, according to the present invention, the representative client terminal acquires and encrypts the distributed processing cluster setting file indicated by the received cluster identifier, and the distributed processing cluster receives the encrypted setting file received from the representative client terminal. Decrypt. As a result, since the configuration file is encrypted until it is transferred from the representative client terminal to the distributed processing cluster, the configuration file is not altered or intercepted by a third party on the way, and can be controlled safely. A cluster distributed processing environment can be realized. Furthermore, since the configuration file is encrypted and decrypted by the representative client terminal and the distributed processing cluster, a third reliable terminal is not required for encryption and decryption, so that the multi-cluster distributed processing can be controlled safely. An environment can be realized.

  According to the present invention, the distributed processing cluster processes a command when it is determined that the decrypted setting file is a setting file of the distributed processing cluster. As a result, the distributed processing cluster can determine whether or not to process a command according to whether or not the command is directed to the distributed processing cluster from a representative client terminal that can be trusted. A cluster distributed processing environment can be realized.

  Further, in the multi-cluster distributed processing control system of the present invention, the processing means is provided in each of one or more slave servers constituting the distributed processing cluster, and the command is distributedly processed by each of the processing means. It is characterized by.

  According to the present invention, since only one or more slave servers are provided with only processing means for performing actual processing in the multi-cluster distributed processing control system, the slave servers can be easily scaled out and easily controlled. A multi-cluster distributed processing environment can be realized.

  In the multi-cluster distributed processing control system of the present invention, the input unit receives an electronic signature of a user authenticated by the user authentication unit, and the command transmission unit receives the electronic signature received by the input unit. The command receiving means receives an electronic signature from the representative client terminal, and the distributed processing cluster further comprises an electronic signature authenticating means for authenticating the electronic signature received by the command receiving means. The decrypting means decrypts the encrypted setting file received by the command receiving means when the electronic signature is authenticated by the electronic signature authenticating means.

  According to the present invention, the distributed processing cluster determines whether or not to decrypt the encrypted setting file in response to the authentication of the received electronic signature of the user, that is, determines whether or not to process the command. . Thereby, the distributed processing cluster can determine whether or not to process the command according to whether or not the command is directed to the distributed processing cluster from the user of the reliable client terminal, and can be controlled safely. A multi-cluster distributed processing environment can be realized.

  In the multi-cluster distributed processing control system according to the present invention, the distributed processing cluster further includes log storage means for storing a log of the electronic signature received by the command receiving means.

  According to the present invention, it is possible to store a log of the electronic signature of the user of the client terminal who has instructed the distributed processing cluster to perform the process. As a result, it is possible to manage a user who has instructed the distributed processing cluster to perform processing, and to realize a multi-cluster distributed processing environment that can be controlled safely.

  In the multi-cluster distributed processing control system of the present invention, the setting file stored by the storage unit can be created and edited only from a specific user authenticated by the user authentication unit.

  According to the present invention, since the setting file can be created and edited only by a specific user, the setting file is prevented from being intentionally changed or accidentally edited by a third party, and can be controlled safely. A multi-cluster distributed processing environment can be realized.

  The client terminal of the present invention is a representative client terminal connected from one or more client terminals, and transmits processing commands to two or more distributed processing clusters for distributed processing of the same processing. From the representative client terminal, a storage means for storing a setting file relating to each of the distributed processing clusters, a user authentication means for authenticating a user of the client terminal, and a user authenticated by the user authentication means, the distributed client An input unit that receives a command to be processed in the processing cluster, a cluster identifier that identifies the distributed processing cluster, and obtains a setting file of the distributed processing cluster indicated by the cluster identifier received by the input unit from the storage unit, Encryption means for encrypting, and the encryption means A command transmission unit that transmits the encrypted configuration file and the command received by the input unit to the distributed processing cluster identified by the cluster identifier received by the input unit, and the command transmission unit. Processing result receiving means for receiving the processing result of the transmitted command from the distributed processing cluster; and output means for outputting the processing result received by the processing result receiving means.

  According to the present invention, processing instructions from one or more client terminals to two or more distributed processing clusters are relayed by the representative client terminal. Accordingly, the relay processing related to the multi-cluster distributed processing environment can be unified by the representative client terminal, and a multi-cluster distributed processing environment that can be easily controlled can be realized.

  Further, according to the present invention, the setting file related to each distributed processing cluster is stored in the representative client terminal. As a result, the setting file is stored not in each client terminal but in the representative client terminal. Therefore, it is possible to prevent each client terminal from intentionally changing the setting file on its own terminal or editing it by mistake. A controllable multi-cluster distributed processing environment can be realized.

  According to the present invention, the representative client terminal authenticates the user of the client terminal and then receives a command and a cluster identifier from the user. As a result, a processing command to the distributed processing cluster can be received only from an authenticated user, so a multi-cluster distributed processing environment that can be safely controlled can be realized. Furthermore, since the representative client terminal accepts the cluster identifier of the distributed processing cluster instead of the setting file of the distributed processing cluster to be processed from the user, the processing is not performed based on the unreliable setting file received from the user. A multi-cluster distributed processing environment can be realized.

  In the client terminal of the present invention, the processing means is provided in each of one or more slave servers constituting the distributed processing cluster, and commands are distributedly processed by the processing means. .

  According to the present invention, since only one or more slave servers are provided with only processing means for performing actual processing in the multi-cluster distributed processing control system, the slave servers can be easily scaled out and easily controlled. A multi-cluster distributed processing environment can be realized.

  The distributed processing cluster of the present invention is two or more distributed processing clusters for performing distributed processing of the same processing, and receives a processing command from a representative client terminal connected from one or more client terminals. A command processing unit that is a distributed processing cluster and receives an encrypted setting file and a command from the representative client terminal, and a decrypting unit that decrypts the encrypted setting file received by the command receiving unit; A determination unit that determines whether the setting file decoded by the decoding unit is a setting file of the distributed processing cluster; and when the determination unit determines that the setting file is a setting file of the distributed processing cluster, Processing means for processing a command received by command receiving means, and said processing means Thus is provided with a processing result transmission means for transmitting a processing result of the processed command to the representative client terminal.

  According to the present invention, the distributed processing cluster decrypts the encrypted setting file received from the representative client terminal. As a result, since the configuration file is encrypted until it is transferred from the representative client terminal to the distributed processing cluster, the configuration file is not altered or intercepted by a third party on the way, and can be controlled safely. A cluster distributed processing environment can be realized.

  According to the present invention, the distributed processing cluster processes a command when it is determined that the decrypted setting file is a setting file of the distributed processing cluster. As a result, the distributed processing cluster can determine whether or not to process a command according to whether or not the command is directed to the distributed processing cluster from a representative client terminal that can be trusted. A cluster distributed processing environment can be realized.

  According to the present invention, it is possible to realize a multi-cluster distributed processing environment that can be controlled safely and easily.

1 is a system configuration diagram of a multi-cluster distributed processing control system of an embodiment. FIG. It is a block diagram which shows the function of the representative client terminal of this embodiment. It is a block diagram which shows the function of the distributed processing cluster of this embodiment. It is a block diagram which shows the hardware constitutions of the representative client terminal and distributed processing cluster of this embodiment. It is a sequence diagram which shows the process of the representative client terminal of this embodiment. It is a sequence diagram which shows the process of the distributed processing cluster of this embodiment.

  Embodiments of the present invention will be described with reference to the accompanying drawings. Where possible, the same parts are denoted by the same reference numerals, and redundant description is omitted.

(Configuration of multi-cluster distributed processing control system 1)
FIG. 1 is a system configuration diagram of a multi-cluster distributed processing control system 1 according to the present embodiment. As shown in FIG. 1, the multi-cluster distributed processing control system 1 includes a representative client terminal 2, two or more distributed processing clusters 3, and one or more client terminals 4. As shown in FIG. 1, the client terminal 4 and the representative client terminal 2, and the representative client terminal 2 and the distributed processing cluster 3 are connected to each other through a network or the like.

  The client terminal 4 is composed of an information device such as a PC or a portable terminal. The client terminal 4 commands the distributed processing cluster 3 via the representative client terminal 2, and the processing result is received from the distributed processing cluster 3. Receive via 2.

  The representative client terminal 2 is a terminal that relays between the client terminal 4 and the distributed processing cluster 3, and includes information devices such as a PC and a server. Although one representative client terminal 2 is shown in FIG. 1, it is not limited to one. For example, the multi-cluster distributed processing control system 1 may include two or more representative client terminals 2, and processing based on processing instructions from the client terminals 4 may be distributed to the representative client terminals 2.

  The distributed processing cluster 3 has the same purpose and is a cluster for distributed processing of the same application. As shown in the distributed processing clusters 3a and 3b in FIG. 1, the cluster is a combination of a server that manages and supervises file systems and processes, and a group of servers that hold data and actually perform analysis processing. The distributed processing clusters 3a and 3b are collectively referred to as a distributed processing cluster 3. When instructing processing to a cluster, by specifying a setting file that defines various attributes of the cluster along with the processing contents (command), control the processing for a specific cluster, or use different clusters. can do. The setting file includes a file system that is an attribute of the cluster, an address of a server that manages and controls distributed processing, and a directory that stores data on the server that performs processing.

(Configuration of representative client terminal 2)
Next, the representative client terminal 2 will be described in detail. FIG. 2 is a block diagram illustrating functions of the representative client terminal 2. The representative client terminal 2 includes an authentication unit 20 (user authentication unit), an input unit 21 (input unit), a storage unit 22 (storage unit), a command analysis / creation unit 23, an encryption unit 24 (encryption unit), a transmission A unit 25 (command transmission unit), a reception unit 26 (processing result reception unit), and an output unit 27 (output unit) are configured.

  The representative client terminal 2 configured in this way is configured by the hardware shown in FIG. FIG. 4 is a hardware configuration diagram of the representative client terminal 2 (and the distributed processing cluster 3). As shown in FIG. 4, the representative client terminal 2 shown in FIG. 2 physically includes a CPU 41, a RAM 42 and a ROM 43 as main storage devices, an input device 44 such as a keyboard and mouse as input devices, a display, and the like. The computer system includes an output device 45, a communication module 46 that is a data transmission / reception device such as a network card, and an auxiliary storage device 47 such as a hard disk. Each function described in FIG. 2 has an input device 44, an output device 45, and a communication module 46 under the control of the CPU 41 by reading predetermined computer software on hardware such as the CPU 41 and the RAM 42 shown in FIG. This is realized by reading and writing data in the RAM 42 and the auxiliary storage device 47. Hereinafter, each functional block will be described based on the functional blocks shown in FIG.

  The authentication unit 20 authenticates the user of the client terminal 4. For example, the authentication unit 20 checks the user's account and password to authenticate that the user is a legitimate user.

  The input unit 21 receives a command to be processed in the distributed processing cluster 3 and a cluster identifier for identifying the distributed processing cluster 3 from the user authenticated by the authentication unit 20. Further, the input unit 21 may accept the electronic signature of the user authenticated by the authentication unit 20. Note that the user's electronic signature is necessary for recording an access log by the storage unit 32, which will be described later, but if it is not necessary, the processing in the multi-cluster distributed processing control system 1 regarding the electronic signature may be omitted.

  The storage unit 22 stores setting files related to each of the distributed processing clusters 3. The setting file stored by the storage unit 22 can be created and edited only from a specific user authenticated by the authentication unit 20. Further, the storage unit 22 may store a secret key in the public key cryptosystem of the representative client terminal 2.

  The command analyzing / creating unit 23 specifies and acquires the setting file of the distributed processing cluster 3 indicated by the cluster identifier received by the input unit 21 from the storage unit 22. Further, the command analysis / creation unit 23 requests an electronic signature from the user of the client terminal 4 as necessary when the setting file is encrypted by the encryption unit 24 described later. When the input unit 21 receives a user's electronic signature in response to a request for an electronic signature from the command analysis / creation unit 23, the command analysis / creation unit 23 receives a command and electronic signature received by the input unit 21, and The transmission unit 25 is instructed to transmit the setting file encrypted by the encryption unit 24 to the distributed processing cluster 3.

  The encryption unit 24 encrypts the setting file specified and acquired by the command analysis / creation unit 23. The encryption unit 24 may encrypt the setting file by using the secret key of the representative client terminal 2 stored by the storage unit 22 when encrypting the setting file.

  The transmission unit 25 transmits the setting file encrypted by the encryption unit 24 and the command received by the input unit 21 to the distributed processing cluster 3 identified by the cluster identifier received by the input unit 21. Further, the transmission unit 25 may transmit the electronic signature received by the input unit 21 to the distributed processing cluster 3.

  The reception unit 26 receives the processing result of the command transmitted by the transmission unit 25 from the distributed processing cluster 3. When the received processing result is encrypted, the receiving unit 26 decrypts it using the secret key of the representative client terminal 2 stored by the storage unit 22. This decryption process may be performed not by the reception unit 26 but by the command analysis / creation unit 23 and the encryption unit 24, or may be performed by a decryption unit (not shown).

  The output unit 27 outputs the processing result received by the receiving unit 26. For example, the output unit 27 may transmit the processing result to the client terminal 4 that has transmitted the command that is the source of the processing result, or may display the processing result on the output device 45.

  The encryption or digital signature method used in the encryption unit 24 or the like is not particularly defined, but a key that uses an asymmetric key and is encrypted or digitally signed and a key that is different from the key that is decrypted by the later-described decryption unit 33 are used. It is desirable to use it. Also, the secret key is held only by each representative client terminal 2 and the distributed processing cluster 3, and the public key is set in advance when the multi-cluster distributed processing control system 1 is constructed, or the processing servers included in the distributed processing cluster 3 are set in advance. It is assumed that it will be distributed statically during setup. The multi-cluster distributed processing control system 1 uses an asymmetric key and does not require a reliable third party server as compared to the case where a shared key is used.

(Configuration of distributed processing cluster 3)
Next, the distributed processing cluster 3 will be described in detail. FIG. 3 is a block diagram showing functions of the distributed processing cluster 3. The distributed processing cluster 3 includes one master 3M and one or more slaves 3S. The master 3M includes a reception unit 30 (command reception unit), an authentication unit 31 (electronic signature authentication unit), a storage unit 32 (log storage unit), a decryption unit 33 (decryption unit), a determination unit 34 (determination unit), and a transmission. The unit 36 (processing result transmission means) is included. The slave 3S includes a processing unit 35 (processing means).

  Note that the master 3M may be constructed of a plurality of servers, and each server may include different functions. The master 3M and the one or more slaves 3S may be constructed as one server.

  The distributed processing cluster 3 configured in this way is configured by the hardware shown in FIG. Similar to the representative client terminal 2, the distributed processing cluster 3 is configured as a computer system shown in FIG. Each function described in FIG. 3 is realized on the hardware shown in FIG. 4 in the same manner as the representative client terminal 2. Hereinafter, each functional block will be described based on the functional blocks shown in FIG.

  The receiving unit 30 receives the encrypted setting file and command from the representative client terminal 2. Further, the receiving unit 30 may receive an electronic signature from the representative client terminal 2.

  The authentication unit 31 authenticates the electronic signature received by the receiving unit 30. Note that the authentication unit 31 may authenticate the electronic signature as necessary.

  The storage unit 32 stores a log of the electronic signature received by the receiving unit 30. Regardless of whether the authentication unit 31 authenticates the electronic signature, a log of the electronic signature received by the receiving unit 30 may be stored. Further, the storage unit 32 may store the public key in the public key cryptosystem of each representative client terminal 2 included in the multi-cluster distributed processing control system 1.

  The decrypting unit 33 decrypts the encrypted setting file received by the receiving unit 30. The decrypting unit 33 may decrypt the encrypted setting file received by the receiving unit 30 when the digital signature is authenticated by the authenticating unit 31. Further, when decrypting the setting file, the decrypting unit 33 may decrypt the setting file by using the public key of the representative client terminal 2 that has transmitted the setting file and stored by the storage unit 32.

  The determination unit 34 determines whether the setting file decoded by the decoding unit 33 is a setting file of the distributed processing cluster 3. For example, the determination unit 34 determines whether or not the address of the server that manages and controls the distributed processing that is the attribute of the distributed processing cluster included in the decrypted setting file is the same as the address of the distributed processing cluster 3. It may be determined whether or not the decrypted setting file is a setting file of the distributed processing cluster 3.

  The processing unit 35 processes the command received by the reception unit 30 when the determination unit 34 determines that the file is the setting file of the distributed processing cluster 3. Further, the processing unit 35 may be provided in each of one or more slave servers that constitute the distributed processing cluster 3, and the command may be distributed and processed in each processing unit 35. At this time, the determination unit 34 may instruct the processing unit 35 of which slave server how to perform the distributed processing based on the contents included in the setting file.

  When it is determined that the setting file decoded by the decoding unit 33 is not the setting file of the distributed processing cluster 3, the processing unit 35 does not perform processing, and the decoding unit 33 Instructs that the setting file is not for the distributed processing cluster 3 and that an error message is transmitted as a processing result.

  The transmission unit 36 transmits the processing result of the command processed by the processing unit 35 to the representative client terminal 2. The transmission unit 36 encrypts the processing result using the public key of the representative client terminal 2 that has transmitted the setting file and stored in the storage unit 32, and transmits the encrypted processing result to the representative client terminal 2. May be. Note that this encryption processing may be performed not by the transmission unit 36 but by the decryption unit 33 or by an encryption unit (not shown).

(Processing of representative client terminal 2)
Next, the process of the representative client terminal 2 of this embodiment is demonstrated. FIG. 5 is a sequence diagram showing processing in the representative client terminal 2 of the present embodiment. Hereinafter, each step will be described.

  First, the setting file relating to each of the distributed processing clusters 3 is stored in advance by the storage unit 22 (S60, storage step). Next, the authentication unit 20 authenticates the user of the client terminal 4 (S61, user authentication step). Next, a command to be processed in the distributed processing cluster 3 and a cluster identifier for identifying the distributed processing cluster 3 are received from the user authenticated in S61 by the input unit 21 (S62, input step). Next, the command analysis / creation unit 23 identifies and acquires the setting file of the distributed processing cluster 3 indicated by the cluster identifier received in S62 from the setting file stored in S60 (S63). Next, the setting file specified and acquired in S63 is encrypted by the encryption unit 24 (S64, encryption step), and the encrypted setting file is transmitted to the command analysis / creation unit 23.

  Next, the command analysis / creation unit 23 requests the user's digital signature from the user of the client terminal 4, and the input unit 21 receives the user's digital signature (S65). Next, the command analyzing / creating unit 23 transmits the command received in S62, the setting file encrypted in S64, and the electronic signature received in S65 to the distributed processing cluster 3. 25. Next, the transmission unit 25 transmits the command, the encrypted setting file, and the electronic signature to the distributed processing cluster 3 identified by the cluster identifier received in S62 (S66, command transmission step).

  After S66, S81 to S87 described later are executed on the distributed processing cluster 3 side. After S87, the reception unit 26 receives the encrypted processing result of the command transmitted in S87 (S67, processing result receiving step). Next, the reception unit 26 decrypts the encrypted processing result (S68). Next, the output unit 27 outputs the processing result decoded in S68 (S69, output step).

(Processing of distributed processing cluster 3)
Next, processing of the distributed processing cluster 3 of this embodiment will be described. FIG. 6 is a sequence diagram showing processing in the distributed processing cluster 3 of this embodiment. Hereinafter, each step will be described.

  After the above-described S66, the receiving unit 30 receives the command transmitted in S66, the encrypted setting file, and the electronic signature (S80, command receiving step). Next, the authentication unit 31 authenticates the electronic signature received in S80 (S81). Next, the electronic signature received in S80 is stored as a log by the storage unit 32 (S82). Note that the order of S81 and S82 may be reversed.

  Next, the encrypted setting file received in S80 is decrypted by the decryption unit 33 (S83, decryption step). Next, the determination unit 34 determines whether or not the setting file decoded in S83 is the setting file of the distributed processing cluster 3 (S84, determination step). Next, when the processing unit 35 determines in S84 that the file is the setting file of the distributed processing cluster 3, the command received in S80 is processed (S85, processing step). Next, the processing result of the command processed in S85 is encrypted by the transmission unit 36 (S86). Next, the processing result encrypted in S86 is transmitted to the representative client terminal 2 by the transmission unit 36 (S87, processing result transmission step).

(Operation and effect of the multi-cluster distributed processing control system 1)
Next, operational effects of the multi-cluster distributed processing control system 1 including the representative client terminal 2 and the distributed processing cluster 3 according to the present embodiment will be described.

  According to this embodiment, processing commands from one or more client terminals 4 to two or more distributed processing clusters 3 are relayed by the representative client terminal 2. Thereby, the relay processing related to the multi-cluster distributed processing control system 1 can be unified by the representative client terminal 2, and a multi-cluster distributed processing environment that can be easily controlled can be realized.

  Further, according to the present embodiment, the setting file relating to each of the distributed processing clusters 3 is stored by the storage unit 22 of the representative client terminal 2. As a result, since the setting file is stored in the representative client terminal 2 instead of each client terminal 4, each client terminal 4 is prevented from intentionally changing the setting file on its own terminal or editing it accidentally. It is possible to realize a multi-cluster distributed processing environment that can be controlled safely.

  Further, according to the present embodiment, the representative client terminal 2 receives a command and a cluster identifier from the user through the input unit 21 after the authentication unit 20 authenticates the user of the client terminal 4. As a result, a processing command to the distributed processing cluster 3 can be accepted only from an authenticated user, so a multi-cluster distributed processing environment that can be safely controlled can be realized. Furthermore, since the representative client terminal 2 receives the cluster identifier of the distributed processing cluster 3 from the user instead of the setting file of the distributed processing cluster 3 to be processed by the input unit 21, the processing is performed based on the unreliable setting file received from the user. It is possible to realize a multi-cluster distributed processing environment that can be safely controlled.

  Further, according to the present embodiment, the representative client terminal 2 acquires the setting file of the distributed processing cluster 3 indicated by the cluster identifier received by the input unit 21 from the setting file stored by the storage unit 22. The distributed processing cluster 3 decrypts the encrypted setting file received by the receiving unit 30 from the representative client terminal 2 by the decrypting unit 33. As a result, since the configuration file is encrypted until it is transferred from the representative client terminal 2 to the distributed processing cluster 3, the configuration file is not tampered or read by a third party on the way, and can be controlled safely. A multi-cluster distributed processing environment can be realized. Further, since the configuration file is encrypted and decrypted by the representative client terminal 2 and the distributed processing cluster 3, a third reliable terminal is not required for encryption and decryption, so a multi-cluster that can be controlled safely A distributed processing environment can be realized.

  Further, according to the present embodiment, when the encryption unit 24 encrypts the setting file, it encrypts using the secret key of the representative client terminal 2. When the decrypting unit 33 decrypts the setting file, the decrypting unit 33 decrypts the setting file using the public key of the representative client terminal 2 that has transmitted the setting file. In this way, using an asymmetric key does not require a reliable third party server compared to using a shared key. Further, even when two or more representative client terminals 2 are included in the multi-cluster distributed processing control system 1, the public key of each representative client terminal 2 can be stored safely and easily on the distributed processing cluster 3 side. A multi-cluster distributed processing environment can be realized.

  Further, according to the present embodiment, in the distributed processing cluster 3, when the determination unit 34 determines that the decrypted setting file is the setting file of the distributed processing cluster 3, the processing unit 35 processes the command. . Thereby, the distributed processing cluster 3 can determine whether or not to process the command depending on whether or not the command is instructed to the distributed processing cluster 3 from the representative client terminal 2 that can be trusted. A controllable multi-cluster distributed processing environment can be realized.

  Further, according to the present embodiment, when the processing result of the processing executed by the distributed processing cluster 3 is transmitted to the representative client terminal 2, the processing result using the public key of the representative client terminal 2 that has transmitted the setting file. Is encrypted and transmitted to the representative client terminal 2. Then, on the representative client terminal 2 side, the processing result is decrypted using the secret key of the representative client terminal 2 stored by the storage unit 22. As a result, the processing result is encrypted until it is delivered from the distributed processing cluster 3 to the representative client terminal 2, so that the processing result is not tampered or read by a third party along the way, and can be controlled safely. A multi-cluster distributed processing environment can be realized.

  In addition, according to the present embodiment, only one processing unit 35 that performs actual processing in the multi-cluster distributed processing control system is provided in one or more slave servers, so that the slave servers can be easily scaled out. It is possible to realize a multi-cluster distributed processing environment that can be easily controlled.

  Further, according to the present embodiment, the distributed processing cluster 3 determines whether or not to decrypt the setting file encrypted according to the authentication by the authentication unit 31 of the user's electronic signature received by the reception unit 30. That is, it is determined whether or not the processing unit 35 processes the command. Thereby, the distributed processing cluster 3 can determine whether or not to process the command according to whether or not the command is directed to the distributed processing cluster 3 from the user of the reliable client terminal 4, A multi-cluster distributed processing environment can be realized.

  Further, according to the present embodiment, the storage unit 32 can store a log of the electronic signature of the user of the client terminal 4 who has instructed the distributed processing cluster 3 to perform processing. This makes it possible to manage users who have instructed the distributed processing cluster 3 to perform processing, and to realize a multi-cluster distributed processing environment that can be controlled safely.

  In addition, according to the present embodiment, since the setting file can be created and edited only from a specific user, the setting file is prevented from being intentionally changed by a third party or edited accidentally. A multi-cluster distributed processing environment that can be controlled safely can be realized.

DESCRIPTION OF SYMBOLS 1 ... Multi-cluster distributed processing control system, 2 ... Representative client terminal, 20 ... Authentication part, 21 ... Input part, 22 ... Storage part, 23 ... Command analysis and creation part, 24. ..Encryption unit, 25... Transmission unit, 26... Reception unit, 27... Output unit, 3... Distributed processing cluster, 3M.・ Receiving part, 31... Storage part, 32 .. authentication part, 33 .. decoding part, 34 .. judgment part, 35 .. processing part, 36. -Client terminal.

Claims (7)

A multi-cluster distributed processing control system including a representative client terminal connected from one or more client terminals and two or more distributed processing clusters for distributed processing of the same processing,
The representative client terminal is
Storage means for storing a setting file for each of the distributed processing clusters;
User authentication means for authenticating a user of the client terminal;
Input means for receiving a command to be processed in the distributed processing cluster and a cluster identifier for identifying the distributed processing cluster from a user authenticated by the user authentication means;
An encryption unit for acquiring and encrypting the setting file of the distributed processing cluster indicated by the cluster identifier received by the input unit from the storage unit;
A command transmission unit configured to transmit the setting file encrypted by the encryption unit and the command received by the input unit to the distributed processing cluster identified by the cluster identifier received by the input unit;
Processing result receiving means for receiving the processing result of the command transmitted by the command transmitting means from the distributed processing cluster;
Output means for outputting the processing result received by the processing result receiving means;
With
The distributed processing cluster is:
Command receiving means for receiving an encrypted setting file and command from the representative client terminal;
Decryption means for decrypting the encrypted setting file received by the command reception means;
Determining means for determining whether the setting file decoded by the decoding means is a setting file of the distributed processing cluster;
Processing means for processing a command received by the command receiving means when the determining means determines that the file is a setting file of the distributed processing cluster;
Processing result transmission means for transmitting the processing result of the command processed by the processing means to the representative client terminal;
Comprising
A multi-cluster distributed processing control system. The processing means is provided in each of one or more slave servers constituting the distributed processing cluster, and a command is distributedly processed by each of the processing means.
The multi-cluster distributed processing control system according to claim 1. The input means receives an electronic signature of a user authenticated by the user authentication means;
The command transmission means transmits the electronic signature received by the input means to the distributed processing cluster,
The command receiving means receives an electronic signature from the representative client terminal,
The distributed processing cluster further includes an electronic signature authenticating unit that authenticates an electronic signature received by the command receiving unit,
The decrypting means decrypts the encrypted setting file received by the command receiving means when the electronic signature is authenticated by the electronic signature authenticating means;
The multi-cluster distributed processing control system according to claim 1 or 2. The distributed processing cluster further includes log storage means for storing a log of the electronic signature received by the command receiving means.
The multi-cluster distributed processing control system according to claim 3. The setting file stored by the storage unit can be created and edited only from a specific user authenticated by the user authentication unit.
The multi-cluster distributed processing control system according to any one of claims 1 to 4. A representative client terminal connected from one or more client terminals, wherein the representative client terminal transmits a processing command to two or more distributed processing clusters for distributed processing of the same processing;
Storage means for storing a setting file for each of the distributed processing clusters;
User authentication means for authenticating a user of the client terminal;
Input means for receiving a command to be processed in the distributed processing cluster and a cluster identifier for identifying the distributed processing cluster from a user authenticated by the user authentication means;
An encryption unit for acquiring and encrypting the setting file of the distributed processing cluster indicated by the cluster identifier received by the input unit from the storage unit;
A command transmission unit configured to transmit the setting file encrypted by the encryption unit and the command received by the input unit to the distributed processing cluster identified by the cluster identifier received by the input unit;
Processing result receiving means for receiving the processing result of the command transmitted by the command transmitting means from the distributed processing cluster;
Output means for outputting the processing result received by the processing result receiving means;
Comprising
A representative client terminal. Multi-cluster distributed processing control method executed by a multi-cluster distributed processing control system including a representative client terminal connected from one or more client terminals and two or more distributed processing clusters for distributed processing of the same processing Because
A storage step in which the representative client terminal stores a setting file for each of the distributed processing clusters;
A user authentication step in which the representative client terminal authenticates a user of the client terminal;
An input step in which the representative client terminal receives a command to be processed in the distributed processing cluster and a cluster identifier for identifying the distributed processing cluster from the user authenticated in the user authentication step;
An encryption step in which the representative client terminal obtains and encrypts the setting file of the distributed processing cluster indicated by the cluster identifier received in the input step from the setting file stored in the storing step;
Command for the representative client terminal to transmit the setting file encrypted in the encryption step and the command accepted in the input step to the distributed processing cluster identified by the cluster identifier accepted in the input step Sending step;
A command receiving step in which the distributed processing cluster receives the encrypted setting file and the command transmitted in the command transmitting step;
The distributed processing cluster decrypting the encrypted configuration file received in the command receiving step;
A determination step of determining whether the setting file decoded in the decoding step is a setting file of the distribution processing cluster;
A processing step for processing a command received in the command receiving step when the distributed processing cluster is determined to be a configuration file of the distributed processing cluster in the determination step;
A processing result transmission step in which the distributed processing cluster transmits a processing result of the command processed in the processing step to the representative client terminal;
A process result receiving step in which the representative client terminal receives a process result of the command transmitted in the process result transmitting step;
An output step in which the representative client terminal outputs the processing result received in the processing result receiving step;
including,
And a multi-cluster distributed processing control method.

Images